Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux disables AUR package adoption

lwn.net

Post reply on HN
Print view View original

71–80 of 133 posts

Re: Arch Linux disables AUR package adoption

#71

Post by cookiengineer »

WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

> What kind of jerk would attack Arch Linux?

The answer is: Russians

Source: I'm the guy that built the antimiasma mitigation tool [1] and tracked their malware campaign iterations very closely.

Set LANG to ru_RU.* and the malware implant stops spreading itself, as with all APT28/29 malware.

[1] https://github.com/cookiengineer/antimiasma

[2] https://cookie.engineer/projects/cyber-defense/antimiasma.ht...

Re: Arch Linux disables AUR package adoption

#72

Post by michaelmrose »

ivanjermakov wrote: post #28
WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

I'm surprised installing native software is still commonplace. At least in a world of gaming and professional software it's coming from reputable source, but when it comes to PC enthusiasts we've been walking on thin ice for a long time. I also believe this is the main reason why web took off: effortless distribution and sandboxing.

For open source software it would be a massive increase in development time, difficulty, and continued costs that dwarf income to switch to the web. It would be shocking if it happened not the reverse. This is just for application software how do you replace installing a library or development tool with the web?

It's weird that installing software is weird to you.

Re: Arch Linux disables AUR package adoption

#73

Post by thayne »

Alive-in-2025 wrote: post #57
Matl wrote: post #35

Earlier quoted context omitted.

With regards to sandboxing etc. maybe. With regards to packages? Official repos support signing and usually rely on maintainers with proven track records. AUR was a honor system and since some people are total basement losers, you can't rely on that.

We have locks on our doors for a reason. Any software that allows updates and relies on the honor system of "someone else must have checked this" will get hacked. Every day there's yet another certificate or secret stealing infection that is in some random upstream dependency in your dev tools or shell scripts or whatever.

> Any software that allows updates and relies on the honor system of "someone else must have checked this"

That is never how the AUR was supposed to work. Updates were intended to be a manual process where the user reviewed changes to the PKGBUILD.

Re: Arch Linux disables AUR package adoption

#74

Post by static_motion »

WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

The reason is popularity. SteamOS is Arch-based and in the hands of a ton of people who aren't necessarily that technical. CachyOS and EndeavourOS have become very popular with the increasing adoption of desktop Linux. The AUR thus becomes an enticing attack surface.

Re: Arch Linux disables AUR package adoption

#75

Post by Pay08 »

ApolloFortyNine wrote: post #70
vlovich123 wrote: post #29

> The project had suspended new account registration in June. That followed a campaign in which an attacker or attackers created new accounts to adopt orphaned packages and push malicious updates to them that would install malware on user systems. AUR registration was reopened on July 13 after the DevOps team added some minor, and apparently ineffective, restrictions on creating new accounts. Disabling AUR package ad…

>Disabling AUR package adoptions has been like the #1 thing recommended. Do you have a solution to ever reenabling package adoptions? It's pretty much a must have feature for this to exist long term, at least in the AUR's current state where its a repo your not supposed to auto install from but pretty much all users do. Really disabling adoptions is probably step 1 to just EOLing the whole thing. The AUR by definitio…

> Really disabling adoptions is probably step 1 to just EOLing the whole thing.

That's what they should do. The AUR has been a giant fuckup since the beginning, which is especially outrageous seeing as they had the perfect template for it with Gentoo's GURU.

Re: Arch Linux disables AUR package adoption

#76

Post by thayne »

davkan wrote: post #56
nvme0n1p1 wrote: post #23

Earlier quoted context omitted.

It's funny how these people say Linux security is bad because random people can upload arbitrary files to AUR, but won't say Windows security is bad because random people can upload arbitrary files to Microsoft GitHub.

I think the wrongful notion comes from the fact that the vast majority of Arch users use and speak about AUR as if it were a part of arch proper, only paying lip service to reviewing PKGBUILDS, etc. They wrap the default package manager in one that supports AUR and never touch it directly again. It feels closer to if all of GitHub was available in one click through the Microsoft store or windows update. And unfortuna…

Most AUR "helpers" show you the PKGBUILD and/or a diff thereof and ask you to confirm that it looks ok before continuing the install. At least by default.

Maybe most users just ignore that and always answer yes without inspecting it. I don't know. But the wiki for the AUR and Readmes for many of these tools have warning banners telling you not to blindly trust AUR packages.

Re: Arch Linux disables AUR package adoption

#77

Post by Pay08 »

tremon wrote: post #45
jolmg wrote: post #19

Earlier quoted context omitted.

> I'm sure there are legitimate uses of that functionality To avoid package name pollution, e.g. having package foo, foo-newpackage, foo-newpackage-updated, etc. each by a new maintainer as the priors get abandoned.

With a bit more structure, you could change that to: every package in AUR is actually registered as foo/maintainer under the hood, and installing the package without maintainer name pins it to the currently active version. Package adoption can then be formalized as a new maintainer publishing their own version of the package, and users of an already-installed package need to issue an explicit command to switch over t…

Or, have actual user repos like a normal distro.

Re: Arch Linux disables AUR package adoption

#78

Post by catuscubitus »

zache6 wrote: post #20

I haven't been updating AUR packages since the initial incident. Thankfully hadn't updated for a week prior to it. Tonight I'll be uninstalling all the AUR packages I possibly can.

> I haven't been updating AUR packages since the initial incident.

The world of exploits and malware thanks you for your service.

> Thankfully hadn't updated for a week prior to it.

Chances are this started more than a week before it was discovered.

> Tonight I'll be uninstalling all the AUR packages I possibly can.

Instead, you could just use the AUR mindfully in terms of which packages you install and review the code.

Re: Arch Linux disables AUR package adoption

#79

Post by charcircuit »

cube00 wrote: post #27
charcircuit wrote: post #8

AUR should be scanning new uploads for malware before allowing them to be published.

You can only scan for known malware. Plenty of ways to write new apps to do bad things that scanners won't detect.

Just because it's impossible to catch 100% that doesn't mean it is not worth doing.

Re: Arch Linux disables AUR package adoption

#80

Post by charcircuit »

tempfile wrote: post #17
charcircuit wrote: post #8

AUR should be scanning new uploads for malware before allowing them to be published.

What does "scanning for malware" mean? As far as I know this is a totally open question, and the only credible answers (install in a sandbox) are too inconvenient for widespread adoption.

>are too inconvenient for widespread adoption.

The owners of AUR would do this for all packages they host so the inconvenience does not fall on other people. AUR has to take responsibility over the security of what they offer.

Post reply on HN